3 ms·
Linux security model is pretty broken without namespaces. systemd has some bells and whistles that help but if you want something better than environment variab
by cedws 1y ago
Linux security model is pretty broken without namespaces. systemd has some bells and whistles that help but if you want something better than environment variables you're naturally going to reach for cgroups.
- throwaway127482 1y agocgroups aren't relevant here, I think. Not sure if that was just a typo, since you did mention namespaces in the first sentence. PID and user namespaces in particular are relevant here.
- cedws 1y agoYeah seems you're right, I thought namespaces came under the cgroups umbrella.
- ux266478 1y agoLinux's namespaces are not a security mechanism. Please do not use them as one.
- cedws 1y agoI've said exactly the same thing on HN myself. However for this problem what do you suggest? Using namespaces is better than using no namespaces.
- ux266478 1y agoIf I was actually serious about the security of a system, I'd explicitly use virtualization at-minimum. If all I wanted was a mall cop and was happy to take the risk of misconfiguration or attacks on the kernel I'd probably say something that adds a lot of extra sanity to namespaces is "good enough", like bubblewrap. I would never trust it or say that it's secure though.
- jcgl 1y agoIs there consensus around that? Given how containers and bubblewrap/flatpak are considered (to some degree) security boundaries, I approach statements like this with skepticism.
- ux266478 1y agoYou answered your own question. Bubblewrap uses namespaces, but not by themselves. They're used in conjunction with other tools to provide a security boundary. Even then, it's not a very good security boundary. A serious security boundary should hold up even to privilege escalation, which is not true for bubblewrap.
- jcgl 1y agoEach kind of namespace provides its own kind of boundary. Yes, you need something like bubblewrap to stitch that all together. And it is kinda leaky, especially without taking some degree of care. What're you saying about privilege escalation? I don't see how a user namespace does not prevent/limit privilege escalation. More than that, I'm interested if there is some broader consensus I'm missing on the shortcomings of namespaces.
- ux266478 1y ago> I don't see how a user namespace does not prevent/limit privilege escalation. They only prevent a single class of privilege escalation from setuid usage within the namespace. You can still obtain root using race conditions, heap overflows, side-channels, etc. or by coordinating with something outside of the namespace like a typical chroot escape. Here's an old (patched) example of escaping the sandbox: https://lwn.net/Articles/543273/ https://lwn.net/Articles/543273/ > More than that, I'm interested if there is some broader consensus I'm missing on the shortcomings of namespaces. The consensus is that they're not security features on Linux. I'm not sure who sold you on the idea that they were, because that was not handed down by the kernel devs. https://lwn.net/Articles/657744/ https://lwn.net/Articles/657744/
- 1718627440 1y agoLinux/Unix security model is that different actors are represented by different OS users. When you don't do that, it's already like inviting the burglars in your living room.
- oblio 1y agoEverybody does that. How many untrusted NPM dependencies are installed as we speak? Chrome extensions? Etc.
- 1718627440 1y ago"Everybody" runs an operating system, where it is common to install programs by downloading random files from the internet and then clicking OK to any UAC prompt. Doesn't mean that this is not insecure.